sync: agent/API transport and apply engine (#26)

* sync: agent/API transport and apply engine

PR 2 of grain sync: syncFS adapters (agentSyncFS, apiSyncFS), safeRelJoin
path containment, and applySyncPlan with conflict barrier (exit 2, no
writes) and crash model A (state file only after full success).

Covered with mem guest FS apply tests and httptest agent/API transport tests.
CLI surface remains PR 3.

* test(sync): fix unused st assignment (SA4006)

* fix(sync): silence staticcheck SA9003 and unparam on apply

Author: cxdy